Silent SectorUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
HITRUST
HITRUST is a private assurance program built on the HITRUST CSF, a control framework that harmonizes HIPAA, NIST, ISO, PCI and many other sources. It is used mostly by healthcare organizations and their vendors, but the framework is industry neutral.
There are three validated assessment types: e1 (Essentials, about 44 requirements, one-year certification), i1 (Implemented, 182 threat-adaptive requirements, one-year certification) and r2 (Risk-based, tailored scope, two-year certification with an interim assessment at twelve months).
Assessments are recorded in the MyCSF platform, validated by an Authorized External Assessor, and then reviewed by HITRUST's own quality assurance team before a certification report is issued.
In writing, an assessed entity needs the policy and procedure documents behind every in-scope requirement, because HITRUST scores policy, procedure, implementation and (for r2) measured and managed maturity levels separately.
That means a documented scope and system inventory, a policy set covering the CSF domains, procedures that match practice, and implementation evidence sampled by the assessor. CSF v11 is current; e1 and i1 assessments must be created on v11.7.0 or later since March 31, 2026.
Share
Ad from the publisher
Policy Acknowledgment Proof
AcknowledgedPolicy set v3by name, on record
Policy Level Fully Metwith AllyMatter
Certify the Modern WayThe policy layer under every HITRUST control, acknowledged
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every name on record
Who read which version, and when
03
Hand the assessor the trail
From $29/mo, 20 editors, unlimited staff (published)
Who has to comply
Voluntary and contractual. Health plans, hospital systems and payers often require HITRUST certification from vendors handling PHI; some cloud and SaaS providers pursue it for market access. No statute requires it.
What the assessor asks to see
Scope definition and system inventory in MyCSF; policies and procedures for each in-scope requirement statement; implementation evidence per control (configurations, screenshots, access reviews, logs, training records); prior assessment results and corrective action plans; inheritance letters from cloud providers; management representation letter; for r2, measurement and management evidence for higher maturity scores.
Where the requirement sits: HITRUST CSF PRISMA maturity: Policy (~15%), Procedure (~20%), Implemented (~40%), Measured (~10%), Managed (~15%)
Assessment types
e1: foundational, fixed requirement set, one-year certification, suited to lower-risk entities. i1: leading-practice set of 182 requirements updated for current threats, one-year certification. r2: risk-tailored scope with maturity scoring across policy, procedure, implemented, measured and managed levels, two-year certification with an interim review.
Work done for e1 or i1 can be carried forward into the larger assessments.
Every internal policy in one place
AllyMatter is a full system for every internal policy your company keeps, including the ones HITRUST turns on. Build the whole library in one place, across every department, and prove who has read what.
Start here
Written Information Security Plan: who needs it, what goes in it, how often it is reviewed and who signs it off. Run exactly that in AllyMatter, alongside every other policy your company keeps.
How it works
Every document is approved by someone other than its author, versioned, distributed to the people it covers and acknowledged by name. Sign it where a signature is what the standard wants, send a set out together as a package, and export a dated record of who read which version when an assessor asks.
The written policies this standard turns on live here, with every version and every acknowledgment on the record.
Who helps with HITRUST
Yes. HITRUST Readiness Licensees and many Authorized External Assessor firms sell readiness services (scoping, gap assessment, policy writing, MyCSF setup, remediation). The readiness firm and the validating assessor can be the same organization in HITRUST's model, subject to independence requirements, or different firms.
Firms that name this framework in their own material. A listing is not a recommendation. Each firm can confirm its own.
Listed in random order, reshuffled each time the page loads. Firms that pay for a listing are shown at the top, labeled Sponsored.
TruvantisSan Francisco, CA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
CisoshareSan Clemente, CA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
ArchlightMinneapolis, MN, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, ISO 42001 and more.
- Standards
- Pricing
- Not published
Coral EsecureNew Jersey, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
CycoreMiami, FL, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
IllumenSeattle, Washington
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Neutral PartnersOrlando, Florida
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Securis360Dallas, Texas
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, GDPR and more.
- Standards
- Pricing
- Not published
Soter AdvisoryUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
TestprosSterling, Virginia
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
TrustedCISOCharlotte, North Carolina, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
vCISO.comPittsburgh, Pennsylvania, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Atlant SecurityUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Global Quality Services (GQS India)Bengaluru, Karnataka, India
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
AmomittoUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, HIPAA, CMMC, PCI DSS, GDPR and more.
- Standards
- Pricing
- Not published
Angel CybersecuritySan Francisco, CA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, SOC 2, HIPAA, PCI DSS.
- Standards
- Pricing
- Not published
CitsapHouston, TX, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, SOC 2, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
MuroSheridan, WY, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, HIPAA, PCI DSS, GDPR, NIST CSF and more.
- Standards
- Pricing
- Not published
Prodigy 13New York, NY, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, HIPAA, PCI DSS, GDPR, FedRAMP and more.
- Standards
- Pricing
- Not published
RSI SecuritySan Diego, CA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, HIPAA, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
Audit Liaison, LLCTampa, FL, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 9001, HIPAA, CMMC, PCI DSS and more.
- Standards
- Pricing
- Not published
Corporate Prime Solutions Inc.Vancouver, BC, Canada
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, SOC 2, ISO 9001, HIPAA, ISO 22301 and more.
- Standards
- Pricing
- Not published
QualitcertBengaluru, Karnataka, India
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, ISO 9001, PCI DSS and more.
- Standards
- Pricing
- Not published
GQSSingapore
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, ISO 9001, HIPAA and more.
- Standards
- Pricing
- Not published
Gigit SecurityBoulder, CO, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, CMMC, NIST 800-171, PCI DSS, FedRAMP and more.
- Standards
- Pricing
- Not published
CyberCrestEncinitas, CA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, SOC 2, ISO 9001, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
BD EmersonRichmond, VA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, SOC 2, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
Mildeeng SystemsBeltsville, MD, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 9001, CMMC, NIST 800-171, FedRAMP and more.
- Standards
- Pricing
- Not published
Microminder Cyber SecurityStanmore, London, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, SOC 2, NIST 800-171, PCI DSS, GDPR and more.
- Standards
- Pricing
- Not published
Truvo CyberOttawa ON, Canada
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, HIPAA, CMMC, NIST 800-171, GDPR and more.
- Standards
- Pricing
- Not published
RB Advisory LLCWinter Park, FL, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Socium SecuritySan Clemente, California, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
CompassMSPWest Hartford, CT, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
DTSArlington, VA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
DevilDog CybersecurityDenver, CO, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Axiom GRCUK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, ISO 9001, CMMC, PCI DSS and more.
- Standards
- Pricing
- Not published
NovacoastWichita, KS, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
TealAlexandria, VA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, SOC 2, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
Layer 8 Security, LlcMalvern, Pennsylvania, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, HIPAA, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
YGI SolutionsNew York, New York, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
RoundTable TechnologyLewiston, Maine, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, HIPAA, PCI DSS, GDPR, NYDFS 23 NYCRR 500.
- Standards
- Pricing
- Not published
Virtual GuardianSaint Paul, Minnesota, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
RiveronDallas, Texas, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Anchorpoint Partners
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, ISO 9001, HIPAA and more.
- Standards
- Pricing
- Not published
ITASC SolutionsCalifornia, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Coralis AdvisoryClinton Township, Michigan, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for HITRUST, ISO 27001, SOC 2, HIPAA, GDPR and more.
- Standards
- Pricing
- Not published
Who assesses HITRUST
A HITRUST Authorized External Assessor organization (approved and trained by HITRUST) performs validated assessments; HITRUST itself performs quality assurance and issues the certification. Self-assessments are available for readiness only. Accredited by HITRUST authorizes and periodically requalifies External Assessor organizations; no national accreditation body is involved.
Public register of assessors: hitrustalliance.net ↗
Listed in random order, reshuffled each time the page loads. Firms that pay for a listing are shown at the top, labeled Sponsored.
A-LIGNOn the public register
- What they do
- Assessor
- Which standards
- On the public register for HITRUST, CSA STAR, FedRAMP, StateRAMP.
- Standards
- Pricing
- Not published
CoalfireOn the public register
- What they do
- Assessor
- Which standards
- On the public register for HITRUST, CSA STAR, FedRAMP, StateRAMP.
- Standards
- Pricing
- Not published
Prescient SecurityOn the public register
- What they do
- Assessor
- Which standards
- On the public register for HITRUST, FedRAMP, StateRAMP.
- Standards
- Pricing
- Not published
SchellmanOn the public register
- What they do
- Assessor
- Which standards
- On the public register for HITRUST.
- Standards
- Pricing
- Not published
BARR Advisory, P.A.On the public register
- What they do
- Assessor
- Which standards
- On the public register for HITRUST.
- Standards
- Pricing
- Not published
Tools for HITRUST
Tools that name this framework in their own material.
Grouped by type. Inside each group the order is random, reshuffled each time the page loads. AllyMatter, the publisher of this site, is always first.
AllyMatterPolicy management tool, the policy and acknowledgment layerPublisher of this siteGRC and compliance automation6 tools
Controls, evidence and audit workflows, with a policy module inside.
ThoropassNew York, United StatesCompliance automation platform and audit firm in oneNot publishedStrike GraphAI-native GRC and compliance automation platformPrice publishedOneleetCompliance automation platform with security built inQuote onlyIgnyte Assurance PlatformDayton, OH, USAGRC and compliance automation platformQuote onlyTrustCloudAI-native GRC and cyber risk assurance platformQuote onlyOstendioGRC and security compliance platformPrice published
Related reading
- HITRUST CSF: e1, i1, r2 - what's the difference?Compares the three assessment types by effort, requirement count and validity period, so you can tell which one a customer is asking for.Cloud Security Alliance
- Everything you need to know about HITRUST v11An authorized external assessor explains the threat-adaptive control model, inheritance between assessments, and how validation and QA actually run.Coalfire
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Find a Consultant for HITRUST
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Run the Policy Side of HITRUST in AllyMatter
Approve the policies HITRUST asks for, keep every version, and record a named acknowledgment from each person who has to read them.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff